guard-users-gemini

To add guardrails to Gemini CLI, apply a safety policy that classifies requests into risk classes and requires explicit approvals for destructive actions. This enforces scoped executions and confines operations to the workspace root.

Gemini CLI security policies use risk classifications ranging from Class X to Class 0. Class X refuses catastrophic actions, while Class 2 and Class 3 require explicit approvals using an exact-payload approval format before execution.

Yes, you can require manual approvals for high-risk Gemini CLI commands by enforcing a policy that targets Class 2 and Class 3 risk classifications. These commands require an exact-payload approval format before they can execute.

To stop credential leakage when running Gemini CLI scripts, enforce safe defaults for credential handling and cloud interactions. The guardrail policy confines the working directory to the workspace root to prevent unapproved access.

Yes, the Gemini CLI guardrail policy works for automated local scripts. It applies to Gemini CLI workflows in local workspaces and automated scripts, classifying requests to prevent unsafe changes to system state or credentials.

Risk classification policies require exact-payload approvals for Class 2 and Class 3 actions, which can halt automated scripts if approvals are not pre-configured. Workdir is strictly confined to the workspace root, limiting cross-directory operations.